6.5

CVE-2017-0896

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zulip ≫ Zulip Server Version1.3.0
Zulip ≫ Zulip Server Version1.3.1
Zulip ≫ Zulip Server Version1.3.2
Zulip ≫ Zulip Server Version1.3.3
Zulip ≫ Zulip Server Version1.3.4
Zulip ≫ Zulip Server Version1.3.6
Zulip ≫ Zulip Server Version1.3.7
Zulip ≫ Zulip Server Version1.3.8
Zulip ≫ Zulip Server Version1.3.9
Zulip ≫ Zulip Server Version1.3.10
Zulip ≫ Zulip Server Version1.3.11
Zulip ≫ Zulip Server Version1.3.12
Zulip ≫ Zulip Server Version1.3.13
Zulip ≫ Zulip Server Version1.4.0
Zulip ≫ Zulip Server Version1.4.1
Zulip ≫ Zulip Server Version1.4.2
Zulip ≫ Zulip Server Version1.4.3
Zulip ≫ Zulip Server Version1.5.0
Zulip ≫ Zulip Server Version1.5.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.28% 0.662
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b
Patch
Issue Tracking
https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ
https://hackerone.com/reports/224210
Permissions Required